The DevOps 2.4 Toolkit

Using ServiceAccounts from side-car containers

We still have one more pending issue that we can solve with ServiceAccounts. In the previous chapter we tried to use cvallance/mongo-k8s-sidecar container in hopes it'll dynamically create and manage a MongoDB replica set.

We failed because, at that time, we did not know how to create sufficient permissions that would allow the side-car to do its job. Now we know better.

Let's take a look at an updated version of our go-demo-3 application.

 1  cat sa/go-demo-3.yml

The relevant parts of the output are as follows

...
apiVersion: v1
kind: ServiceAccount
metadata:
  name: db
  namespace: go-demo-3
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: db
  namespace: go-demo-3